ArcGIS general raster security update: use-after-free
Priority LOW 37CWE-416Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.
Summary
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
Why it matters now
EPSS 0.01577 75th percentileScored 2026-11-07
Fix Fixed ArcReader (Esri): 10.9.0ArcGIS Desktop (Esri): 10.9.0+3 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Esri | ArcReader | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Desktop | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Engine | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Engine | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Engine | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Engine | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Desktop Background Geoprocessing | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Engine Background Geoprocessing | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
| Esri | ArcGIS Engine Background Geoprocessing | All to before 10.9.0 | 10.9.0 | Patch available | CNA |
- ArcReader VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Desktop VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Engine VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Engine VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Engine VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Engine VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Desktop Background Geoprocessing VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Engine Background Geoprocessing VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
- ArcGIS Engine Background Geoprocessing VendorEsri Affected All to before 10.9.0 Fixed in 10.9.0 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:esri:arcgis_engine:*:*:*:*:*:*:*:* | up to 10.8.1 | Vulnerable | Esri |
| cpe:2.3:a:esri:arcgis_pro:*:*:*:*:*:*:*:* | up to 2.7 | Vulnerable | Esri |
| cpe:2.3:a:esri:arcmap:*:*:*:*:*:*:*:* | up to 10.8.1 | Vulnerable | Esri |
| cpe:2.3:a:esri:arcreader:*:*:*:*:*:*:*:* | up to 10.8.1 | Vulnerable | Esri |
- cpe:2.3:a:esri:arcgis_engine:*:*:*:*:*:*:*:* Versions up to 10.8.1 Vulnerable ·Esri
- cpe:2.3:a:esri:arcgis_pro:*:*:*:*:*:*:*:* Versions up to 2.7 Vulnerable ·Esri
- cpe:2.3:a:esri:arcmap:*:*:*:*:*:*:*:* Versions up to 10.8.1 Vulnerable ·Esri
- cpe:2.3:a:esri:arcreader:*:*:*:*:*:*:*:* Versions up to 10.8.1 Vulnerable ·Esri
Remediation
- Fix · CNA ArcReader (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Desktop (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Engine (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Engine (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Engine (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Engine (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Desktop Background Geoprocessing (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Engine Background Geoprocessing (Esri) Fixed in 10.9.0
- Fix · CNA ArcGIS Engine Background Geoprocessing (Esri) Fixed in 10.9.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Esri ArcGIS Desktop, ArcGIS Engine, ArcReader 10.9.0
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2021-09985 ArcGIS general raster security update: uninitialized pointerPriority MEDIUM 40
- TI-2021-09984 ArcGIS general raster security update: buffer overflowPriority LOW 39
- Release ·
Esri ArcGIS Desktop Background Geoprocessing 10.9.0
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-09985 ArcGIS general raster security update: uninitialized pointerPriority MEDIUM 40
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29096
- 2026-10-03 Alias added: GHSA-8vhv-h63p-g472
References
More Esri Arcgis Engine vulnerabilities
- TI-2021-09985 ArcGIS general raster security update: uninitialized pointer CVSS 3.1HIGH 7.8
- TI-2021-09984 ArcGIS general raster security update: buffer overflow CVSS 3.1HIGH 7.8
Sources
- CVE-2021-29096 · CVE Program
- CVE-2021-29096 · NVD
- FIRST EPSS
- GHSA-8vhv-h63p-g472 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences